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Report on Protected Disclosures 2018 


Protected disclosures received by the office of the Data Protection Commissioner covering the 
period from 1 January 2018 to 24 May 2018 


Protected disclosures received by the Data Protection Commission covering the period from 25 
May 2018 to 31 December 2018 


Establishment of new Data Protection Commission 

The office of the Data Protection Commissioner was established under the Data Protection Acts 1988 
and 2003. The functions of the Data Protection Commissioner were those set out in section 9 of the 
1988 Act as amended. As of 25 May 2018, the Data Protection Commissioner has been replaced by a 
newly constituted Data Protection Commission. Under and by virtue of section 14 of the Data 
Protection Act 2018, all functions previously vested in the Data Protection Commissioner have been 
transferred to the Commission. 


Accordingly, the new Data Protection Commission has prepared this 2018 Report on Protected 
Disclosures. This Report sets out the protected disclosures received by — 


e the office of the Data Protection Commissioner during the period from 1 January 2018 to 24 
May 2018, and 


e the newly constituted Data Protection Commission during the period from 25 May 2018 to 31 
December 2018. 


DPC policy on protected disclosures 

The policy of the Data Protection Commission under the terms of the Protected Disclosures Act 2014 
is designed to facilitate and encourage all workers to raise internally genuine concerns about 
possible wrongdoing in the workplace so that these concerns can be investigated following the 
principles of natural justice and addressed in a manner appropriate to the circumstances of the case. 


Section 22 of the Protected Disclosure Act 2014 requires public bodies to prepare and publish, by 
30th June in each year, a report in relation to the previous year in an anonymised form. 


Office of the Data Protection Commissioner: 
Protected Disclosures received during the period from 1 January 2018 to 24 May 2018 


Pursuant to section 22 of the Protected Disclosure Act 2104, the Data Protection Commission 
confirms that for the period 1 January 2018 to 24 May 2018 


e No internal protected disclosures (from staff of the office of the Data Protection 
Commissioner) were received. 


e Two protected disclosures (set out in the table below) were received from individuals 
external to the Office in relation to issues pertaining to data protection within other entities. 


These cases were raised with the office of the Data Protection Commissioner in its role as a 
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‘prescribed person’ as provided for under section 7 of the Protected Disclosures Act (listed 


in SI 339/2014, as amended by SI 448/2015). 


Reference No Type Date Received Status Outcome 

1/19/1/7 Section 7 22 April 2018 Closed Closed - 
(external, to ODPC complainant did 
as 'prescribed not pursue 
person’) matter. 

1/19/1/6 Section 7 19 April 2018 Closed Closed - 
(external, to ODPC complainant did 
‘prescribed not pursue 
person’) matter. 


Data Protection Commission: 
Protected Disclosures received during the period from 25 May 2018 to 31 December 2018 


Pursuant to section 22 of the Protected Disclosure Act 2104, the Data Protection Commission 
confirms that for the period 25 May 2018 to 31 December 2018 


e No internal protected disclosures (from staff of the Commission) were received. 


e Three protected disclosures (set out in the table below) were received from individuals 
external to the Commission in relation to issues pertaining to data protection within other 
entities. These cases were raised with the Data Protection Commission in its role as a 
‘prescribed person’ as provided for under section 7 of the Protected Disclosures Act (listed 
in SI 339/2014, as amended by SI 448/2015). 


Reference No Type Date Received Status Outcome 

1/19/1/10 Section 7 27 October 2018 Open Matter being 
(external, to DPC investigated 
as 'prescribed under Article 
person’) 57(1)(f) of the 

GDPR 

1/19/1/9 Section 7 5 September 2018 Closed Closed - 
(external, to DPC complainant did 
as 'prescribed not pursue 
person’) matter. 

1/19/1/8 Section 7 22 June 2018 Closed Closed - 
(external, to DPC complainant did 
as 'prescribed not pursue 
person’) matter. 
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